secureforms_8prg_source.html

<?php

  /*
   * File: secureforms.prg
   *
   * Purpose: Used by hcuForms.prg and Custom Content/ SecureForms
     * to find the cu's public directory and target form.
     * Replaces secureforms in Mammoth.
   *
   */

// ** INCLUDE MAIN GLOBAL SCRIPT -- Handles security / global variable values
require_once(dirname(__FILE__) . '/../library/hcuService.i');

/*
* ** CHECK USER FEATURE PERMISSIONS **
* NOTE: DOES NOT RETURN ON FAILURE
*/
PermCheckFeatureScreen($dbh, $HB_ENV, $MC, FEATURE_BASIC);

// ** INSERT BUSINESS LOGIC FOR THIS FORM
$Cu = $HB_ENV["Cu"];

$protectdir = "/home/$Cu/public_html";

$dms_ok = array('Flang' => 'string','speak' => 'string');

dms_import($dms_ok);

$filename = $protectdir . HCU_array_key_value("PATH_INFO", $_SERVER);
$filemime = mime_content_type($filename);

$notallowed = ';$*\\,`&|:?<>"';

if (strpos($filename,'/.') === false && strpbrk($filename,$notallowed) === false && is_readable($filename)) {

    switch($filemime) {
        case "application/pdf":
            header('Content-Type: application/pdf');
            header("Content-Disposition: attachment;filename='" + $filename);
            readfile($filename);
        break;

        default:
            readfile($filename);
    }

} else {
   header("Status: 404 Not Found");
     print "<HTML><HEAD><TITLE>404 " . $MC->msg('Not Found') . "</TITLE>
</HEAD><BODY>
<H1>" . $MC->msg('Not Found') . "</H1>" .
$MC->msg('The requested URL') . " ${_SERVER['PHP_SELF']} " .
$MC->msg('was not found on this server') . ". <P>
<HR>
<ADDRESS>${_SERVER['SERVER_SIGNATURE']}</ADDRESS>
</BODY></HTML>";
}
?>